feat: Phase 6 cutover — delete Java reference, ship v1.0.0 (#132) #138

Job	Run time
Trivy (filesystem + container scan)	8s
jscpd (duplication < 3% on touched code)	13s
SBOM (SPDX + CycloneDX)	18s
OSV-Scanner (SCA)	6s
Semgrep (SAST)	31s
Gitleaks (secret scan)	11s
	1m 27s

Provide feedback